Summary

• Replace != string comparison with crypto/subtle.ConstantTimeCompare for client secret verification in the OAuth token endpoint
• Replace != string comparison with crypto/subtle.ConstantTimeCompare for OTP verification in verify_otp and reset_password flows
• Prevents timing side-channel attacks that could allow progressive secret/OTP extraction

Files Changed

• internal/http_handlers/token.go — client_secret comparison
• internal/graphql/verify_otp.go — OTP comparison
• internal/graphql/reset_password.go — OTP comparison

Test plan

• make test-sqlite passes (no regressions)
• Verify token endpoint still accepts valid client_secret
• Verify OTP verification still works end-to-end